Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-81729— Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion

Quick assessment

Affected
Dolibarr dolibarr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Dolibarr 23.0.4 版本之前，REST API 的文档删除功能对权限的校验存在错误。具体来说， 中的 方法在处理 请求时，调用 时传入的模式参数为 （读权限）；而同一文件中负责创建文档的 路径则传入 （写权限），后者才是针对修改数据操作的正确权限模式。 因此，一个仅拥有带文档模块的只读权限（例如 或 ），但不具备创建、写、删除或管理员权限的已认证 API 用户，也能通过该权限检查，从而永久删除该模块下的文档：包括第三方文件、发票、订单、报价单、项目文件以及生成的 PDF 文件，且删除后无法恢复。 在

CVSS 6.5 · Medium

Possible ATT&CK Techniques 1 AI

T1565.001 · Stored Data Manipulation
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-81729

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion
Source: CVE Program / CVE List V5
Vulnerability Description
Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() in htdocs/api/class/api_documents.class.php calls dol_check_secure_access_document() with the mode argument 'read' when handling DELETE /api/index.php/documents, while the sibling builddoc() path passes 'write', the correct mode for an operation that modifies stored data. An authenticated API user who holds only a read permission for a document-bearing module, for example societe:lire or facture:lire, and no create, write, delete or admin permission, therefore passes the check and can permanently delete that module's documents: third-party files, invoices, orders, proposals, project files and generated PDFs, with no recovery path. The call site is htdocs/api/class/api_documents.class.php:1276 in 23.0.3 and passes 'write' from 23.0.4 onward.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Dolibarr dolibarr 0 ~ 23.0.4 -

II. Public POCs for CVE-2026-81729

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-81729

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-81729 (1)

Vendor Advisories for CVE-2026-81729 (1)

Same Patch Batch · Dolibarr · 2026-08-27 · 3 CVEs total

CVE-2026-81730 8.2 HIGH Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename
CVE-2026-81728 8.1 HIGH Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys

IV. Related Vulnerabilities

Same product: dolibarr
Same vendor: Dolibarr
Same weakness: CWE-863

V. Comments for CVE-2026-81729

No comments yet

Leave a comment